China Isn't Pausing. So What Should America Do Instead?

America Doesn't Need to Slow AI. It Needs to Standardize It.

Washington is fighting over who gets to write the rules. The harder question is whether anyone is building the measurement infrastructure that makes rules, markets and insurance work at all.

In April 2026, state insurance commissioners quietly approved more than 80 percent of carrier requests to strip AI-related damages out of corporate policies, and almost nobody noticed.

That decision will likely shape American AI deployment more than any bill moving through Congress this year. It was not a safety rule. It was not a speed limit. It was a group of underwriters concluding that they cannot price a risk they cannot see, and withdrawing from the market.

This is the part of the debate that keeps getting missed. The binding constraint on American AI is not that it is moving too fast, or that it is being regulated too hard. It is that almost nobody can measure it. Standards, meaning the unglamorous machinery of benchmarks, conformity assessment, audit methods and evaluation science, are not a compromise between acceleration and caution. They are the precondition for both.

The Fight We Are Having Is Not the Fight That Matters

For eighteen months, American AI policy has been a jurisdictional argument wearing a philosophical costume.

The federal position, formalized in Executive Order 14365 in December 2025 and elaborated in the White House's National Policy Framework in March 2026, is that fifty state regimes are a tax on national competitiveness. The framework asks Congress for a "minimally burdensome national standard," establishes a DOJ litigation task force to challenge state laws, and explicitly tells Congress not to create any new federal AI rulemaking body.

The state position is that they filled a vacuum Congress left open. More than 1,200 state AI bills were introduced in 2025 alone. Colorado's AI Act took effect June 30, 2026. California's SB 53 and Texas's TRAIGA landed on January 1. In April, xAI sued Colorado's attorney general over its anti-discrimination statute.

Notice what both sides are arguing about: who holds the pen. Neither is arguing about what the rule should actually say.

That omission is the whole problem. A national standard that preempts state law without specifying anything is not deregulation, and it is not clarity. It is subtraction. It removes fifty imperfect compliance targets and replaces them with zero, which does not reduce uncertainty so much as relocate it, from statehouses to courtrooms, actuarial tables and procurement committees.

The current FRONTIER Act, introduced by Representatives Jay Obernolte and Lori Trahan in July 2026, is narrower: it would displace state law only on catastrophic-risk transparency, third-party auditing and incident reporting. But as Noah Knapp argues in The Regulatory Review, even that is ceiling preemption, a cap states cannot exceed, imposed while we are still learning what AI harms look like.

A ceiling without a floor is just a hole with a lid on it.

The Regulator Nobody Elected

Here is the second-order effect almost no one in the preemption debate is modeling.

While Congress argues about whether to regulate AI, the insurance industry has already begun doing it, badly, and by accident.

A 2025 Geneva Association assessment ran generative AI through the Berliner framework, the nine-criteria test underwriters have used to judge emerging risks for over forty years. Generative AI fails three criteria outright, including maximum possible loss and information asymmetry, and strains the rest. Carriers cannot see which models their insureds run, for which applications, under what governance, or whether claimed controls exist at all.

The consequences are already visible in the capital stack. OpenAI is reportedly capped at roughly $300 million in coverage. Anthropic paid a $1.5 billion copyright settlement off its own balance sheet. The specialty AI liability products that do exist top out around $25 to $50 million per insured, against litigation exposures running into the billions.

Meanwhile, standard vendor terms cap model-provider liability at roughly twelve months of fees. Residual risk flows downhill: from labs, to large enterprise deployers, to small and mid-sized firms, and finally to consumers who hold no contract and no coverage at all.

For most American businesses, an activity that cannot be insured is an activity that is effectively prohibited. We are building a de facto AI ban out of actuarial uncertainty, and calling it a free market.

Aon's Kevin Kalinich put the point to the Senate Banking Subcommittee in July 2025: underwriting standards, he noted, often function as a form of guardrails. He is describing how insurance has disciplined every transformative technology since steam, from boiler inspection to fire codes to automotive safety. It worked because insurers could inspect the boiler.

Nobody can inspect a foundation model's deployment context today. There is no questionnaire, no attestation regime, no accredited third-party verifier, no analogue to the cyber underwriting checklists that became the de facto IT security baseline in the 2010s.

Cyber insurance took roughly twenty years to mature. AI is on a far faster clock, and the slow variable is not the technology. It is the measurement science.

Europe Proved the Point by Accident

The strongest evidence for this argument comes from the jurisdiction that supposedly chose the opposite path.

The EU AI Act was the world's most ambitious binding AI law. In November 2025, the Commission proposed deferring its high-risk obligations from August 2026 to December 2027. The trilogues concluded in 2026, and the delay held.

The reason is instructive. The Act did not stall on politics, lobbying or enforcement appetite. It stalled because CEN and CENELEC had not finished the harmonised standards that give the law operational meaning. Those are now expected in late 2026 or early 2027.

Read that again. Europe wrote the rule and then discovered it could not be complied with, because the measurement layer underneath it did not exist yet.

A law that says "high-risk AI systems must be accurate, robust and non-discriminatory" is a sentence, not a standard. It becomes a standard only when someone specifies the test, the threshold, the sampling method, the documentation format and the body qualified to check. Everything upstream of that is intention.

Europe and the United States are converging on the same bottleneck from opposite directions. Europe legislated first and found the standards missing. America is deregulating first, and will find the standards equally missing, only without a forcing function to build them.

Standards Are Trade Policy by Another Name

The third-order effect is geopolitical, and it is the one American policymakers systematically underrate because standards work looks like plumbing rather than power.

It isn't. Beijing understood this a decade ago. China Standards 2035 reflects a long-running state view, documented by the Atlantic Council, that standards are instruments of technological influence rather than technical housekeeping. Chinese participation in ISO, IEC and ITU technical committees has risen accordingly, though research from CIGI suggests its actual influence over core digital standardization remains more constrained than the headlines imply.

Which means the position is still open, and that is precisely why it matters now.

Here is the mechanism. Standards determine conformity assessment. Conformity assessment determines market access. If a hospital system in Jakarta, a bank in Lagos or a telecom operator in Sao Paulo wants to deploy AI in a regulated workflow, it will adopt whichever evaluation regime its regulator, auditor and insurer recognize. That choice is made once and persists for decades, because retooling an audit regime is enormously expensive.

The countries that will decide the global AI standards question are not the ones building frontier models. They are the ones buying them. The United States is currently competing for that market with no exportable conformity package at all.

ISO/IEC 42001 and the NIST AI Risk Management Framework are the two serious contenders, and the RMF is the stronger American asset: voluntary, outcome-based, already referenced in state statutes, already translated into 230 mapped control objectives by Treasury's February 2026 financial services framework. It is genuinely good infrastructure that America has been treating as optional paperwork rather than strategic export.

What Standardizing Would Actually Look Like

The encouraging thing is that the institutional scaffolding already exists. It is just badly undercapitalized and politically unloved.

The Center for AI Standards and Innovation, created inside NIST in June 2025 out of the former AI Safety Institute, is the right body. By June 2026 it had model review agreements with Anthropic, Google, Microsoft and OpenAI. In March 2026 it signed an MOU with GSA to build evaluation methodology into federal procurement through the USAi platform.

That last item is the quietly important one, because procurement is the fastest standards-diffusion mechanism the American state possesses. FedRAMP did more to standardize cloud security practice than any statute. When the federal government specifies how it evaluates an AI system before purchase, that methodology propagates into every vendor's product roadmap within two budget cycles, regardless of what Congress does.

So a serious standardization agenda has three parts, none of which require resolving the preemption fight:

• Fund measurement science at the scale of the problem. Evaluation methodology is a public good that no single lab will build and no competitor will trust if a rival builds it. CAISI's mandate is sound; its budget is not remotely proportional to a technology absorbing hundreds of billions in capital expenditure.
• License independent verification organizations. This is CSIS's core recommendation, and the missing institutional layer. Accredited third parties that audit against published standards are what converted cyber risk, building safety and food processing from guesswork into underwriting. Without them, no insurance market can form.
• Set a federal floor, not a ceiling. Preemption that caps state experimentation forecloses the only real-world evidence generation currently happening, at exactly the moment we most need to learn what AI failure modes actually look like.

None of this is a brake. Every item on that list is an accelerant, because each one converts an unmeasurable liability into a priceable, insurable, procurable risk.

The Thing Nobody Is Counting

There is a version of the next three years where America wins the model race and loses the deployment race.

In that version, the best systems in the world are built in California and Washington, and they sit unused across most of the economy, not because anyone banned them, but because no hospital board, no bank's risk committee, no county government and no mid-sized manufacturer can get a straight answer about what happens when the system is wrong. The frontier advances. Diffusion stalls. The productivity gains stay theoretical.

That is not a hypothetical failure mode. It is the current trajectory, visible already in the insurance exclusions, the liability caps and the twelve-month vendor indemnities that quietly push risk onto the parties least equipped to carry it.

Speed and safety were never actually opposed. They were both downstream of the same missing variable.

The real question was never how fast AI should move. It is whether anyone in the system can tell how fast it is moving, and that is a measurement problem, which means it is a solvable one. America built the twentieth century's prosperity substantially on exported metrology: Underwriters Laboratories, NIST's predecessor agencies, the shipping container's dimensional standard, the internet protocol stack. Each one looked like plumbing. Each one turned out to be sovereignty.

The country that writes the test is the country that sets the terms. Right now, that position is vacant.